This step allows the user to define exactly what will be exported, what properties will be included, etc.

This page is not available if the Don't include file system evidence checkbox on the Filesystem types page is selected.

Properties of the Included Files:

Each file in the File system evidence has properties that are displayed in the Properties pane.

To define which file properties will be added to the report, select the required category in the Category list and select the required file system properties in the list to the right. In the Category list, select only the file system(s) evidence added to Electronic Evidence Examiner. If the selected file system evidence is not added to Electronic Evidence Examiner, selected properties will not be added to the report.

Use Filters

Select this check box to set the date parameters for the searched data.

To set the date parameters:1. Click the Add Filter.2. A new filter is added.3. In the Operator column, select the necessary operator. The following operators are available:

AND: All search results will match this condition.

OR: The search result can match this or any other condition.

AND NOT: All search results will not match this condition.

OR NOT: Some search results will match this condition.

4. In the Type of Date column, select the type for the date. The following types are available:

Any data between: Locates all data that was created, modified, accessed, or changed during the specified date range.

Created between: Locates items created during the specified date range.